﻿using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Text.RegularExpressions;

namespace InformationSystem.WebSite.Utility
{
    public class StringCheck
    {
        public static string GetSafeContent(string str)
        {
            /*
             根据微软提供的建议，我们要慎重允许下列HTML标签，因为这些HTML标签都是有可能导致跨站脚本攻击的。 
            <applet> 
            <body> 
            <embed> 
            <frame> 
            <script> 
            <frameset> 
            <html> 
            <iframe> 
            <img> 
            <style> 
            <layer> 
            <link> 
            <ilayer> 
            <meta> 
            <object> 
             */
            //将输入字符串编码,策略：" 默认禁止，显式允许”
            // 允许的标签 <ul> <li> <div> <strong> <a> <font> <br> <em> <p> <span>

            str = Regex.Replace(str, @"<html[^>]*?>.*?</html>", "",
             RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<html[^>]*?/>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<body[^>]*?>.*?</body>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<body[^>]*?/>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<meta[^>]*?>.*?</meta>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<meta[^>]*?/>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<frame[^>]*?>.*?</frame>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<frame[^>]*?/>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<frameset[^>]*?>.*?</frameset>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<frameset[^>]*?/>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<iframe[^>]*?>.*?</iframe>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<iframe[^>]*?/>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<layer[^>]*?>.*?</layer>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<layer[^>]*?/>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<ilayer[^>]*?>.*?</ilayer>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<ilayer[^>]*?/>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<applet[^>]*?>.*?</applet>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<applet[^>]*?/>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<script[^>]*?>.*?</script>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<script[^>]*?/>", "",
            RegexOptions.IgnoreCase);

            //以下慎重允许
            //flash
            str = Regex.Replace(str, @"<embed[^>]*?>.*?</embed>", "",
           RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<embed[^>]*?/>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<object[^>]*?>.*?</object>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<object[^>]*?/>", "",
            RegexOptions.IgnoreCase);
            //link style
            str = Regex.Replace(str, @"<link[^>]*?>.*?</link>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<link[^>]*?/>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<style[^>]*?>.*?</style>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<style[^>]*?/>", "",
            RegexOptions.IgnoreCase);

            //img
            str = Regex.Replace(str, @"<img[^>]*?>.*?</img>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<img[^>]*?/>", "",
            RegexOptions.IgnoreCase);
            //hyperLink
            //str = Regex.Replace(str, @"<a[^>]*?>.*?</a>", "",
            //RegexOptions.IgnoreCase);
            //str = Regex.Replace(str, @"<a[^>]*?/>", "",
            //RegexOptions.IgnoreCase);

            str = Regex.Replace(str, @"<form[^>]*?>.*?</form>", "",
             RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<form[^>]*?/>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<input[^>]*?>.*?</input>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<input[^>]*?/>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<textarea[^>]*?>.*?</textarea>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<textarea[^>]*?/>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<select[^>]*?>.*?</select>", "",
            RegexOptions.IgnoreCase);
            str = Regex.Replace(str, @"<select[^>]*?/>", "",
            RegexOptions.IgnoreCase);
            return str;
        }
    }
}